Arbah Capital Internal Capital Adequacy Assessment Process Report (ICAAP)

Arbah Capital Internal Capital Adequacy Assessment Process Report (ICAAP) ICAAP Report as of 31 December 2015. 27 April 2016 1

Table of contents 1. EXECUTIVE SUMMARY 3 1.1 Purpose of the report 3 1.2 The framework for the (ICAAP) 3 1.3 The main findings of the ICAAP analysis: 4 2. INTRODUCTION 6 2.1 About this document 6 2.2 Use of ICAAP 6 3. BACKGROUND 6 3.1 Organization & Capital Structure 6 3.2 Overview of Exposures 8 4. SUMMARY OF CURRENT AND PROJECTED FINANCIAL AND CAPITAL POSITIONS 9 5. CAPITAL ADEQUACY AND INTERNAL GOVERNANCE 11 5.1 Internal Structure & Organization 13 5.1.1 Board of Directors 13 5.1.2 Audit & Compliance Committee 13 5.1.3 Executive Directors 14 5.1.4 Management Team 14 5.2 Oversight of Strategy, Polices & Procedures 14 5.2.1 Business Strategy, Plans and Budgets 14 5.2.2 Risk Managements polices & procedures 14 5.2.3 Assurance 14 6. RISK APPETITE AND POLICES 15 6.1 RISK Appetite 15 6.1.1 Liquidity Policy 16 7. KEY RISK AND SENSITVIES 16 7.1 Credit Risk 16 7.1.1 Identification & Measurement 17 7.1.2 Controls & Mitigation 17 7.2 MARKET RISK 20 7.2.1 Identification & Measurement 20 7.3 Liquidity Risk 21 7.3.1 Identification & Measurement 21 7.4 Concentration Risk 21 7.5 Economic Risk 22 7.5..1 Identification & Measurement 22 7.5.2 Controls & Mitigation 22 7.6 Operational Risk - Strategic Risk 22 7.6.1 Identification & Measurement 22 7.6.2 Controls & Mitigation 23 7.7 Business Continuity Plan 23 7.7.1 Identification & Measurement, Controls & Mitigation 23 7.8 Third Party Dependency 23 7.8.1 Identification & Measurement 23 7.8.2 Controls & Mitigation 23 7.9 Fraud 23 7.9.1 Identification & Measurement 23 7.9.2 Controls & Mitigation 24 7.10 IT Security 24 7.10.1 Identification & Measurement 24 7.10.2 Controls & Mitigation 24 7.11 Key Staff 24 7.11.1 Identification & Measurement 24 7.11.2 Controls & Mitigation 24 7.12 Reputational Risk 25 7.12.1 Identification & Measurement 25 7.12.2 Controls & Mitigation 25 7.14 Other Operational Risk 25 8. CHALLENGE AND ADOPTION OF ICAAP 26 8.1 Polices & Risk Assessment 26 8.2 Capital Planning 26 2

1. EXECUTIVE SUMMARY 1.1 The purpose of the report This Internal Capital Adequacy Assessment Process (ICAAP) report is produced annually and Arbah Capital ("Arbah" or "The Bank") own assessment of its internal capital requirements, the primary purpose of the Internal Capital Adequacy Assessment Process (ICAAP) is to ensure that Arbah Capital has sufficient capital at all times to cover the risks associated with its activities, and another purposes of the (ICAAP) is to inform the Board of the ongoing assessment of Arbah risks, how Arbah intends to mitigate those risks and how much current and future capital is necessary having considered other mitigating factors. 1.2 The framework for the (ICAAP) The framework for the (ICAAP) is rooted in part 6(Article 66) and annex 9 of the prudential rules Pillar I, II and III. Pillar I contains a set of rules for calculating the minimum capital requirement, Pillar II describes the APs Internal Capital adequacy assessment process and the supervisory review, while Pillar III contains the disclosure aspect. Arbah approach of calculating its own internal capital requirements consider taking the minimum capital required for credit risk under Pillar 1, assess whether this is sufficient to cover credit risk, then identify other risks and assess prudent levels of capital to meet them. The risk assessment has been undertaken using a scorecard method to assess the likelihood of occurrence and potential impact. Estimates have been further adjusted to take account of (a) the possible margin of error in assessing impact and (b) that in any one year the number of concurrent risks may well exceed the statistical average. Executive Directors will continue to monitor the capital adequacy position, keeping a close eye on the number of customer portfolios and the actual growth in transactions and products against the business plan. Should the capital adequacy headroom fall below regulatory requirements then a formal review of Arbah capital position would be undertaken by the Board. All Arbah policies are reviewed / Approved by the Board at least once annually, the next ICAAP report will be due in one year's time. 3

1.3 The main findings of the ICAAP analysis - Arbah Capital finds that no additional internal capital required comparing with Pillar I calculation. - The current risk management process was updated taking into consideration new guidelines issued by CMA. - In relation to our future plan, Arbah current resources were utilized to a satisfactory degree, currently the assessment shows that there is no needs to increase the capital or this will affect any future plans. - The material risks that Arbah faces is the credit risk loss due to shortfall in the stock market (Credit & Market risk), or unexpected geopolitical risks in the region (other risk), in order to mitigate such risk, Arbah has a written approved investment policy statement that consider risk profile for each investment asset class, Arbah has a well-diversified asset allocation, decisions usually taken by a well formed internal investment committee, the composition includes i.e. CEO, Risk Manager, Compliance officer, Asset Manager, Operation Manager. Arbah consider compliance with exiting strategies in any investments prior entering, so it maintain short term investments horizon, well diversified portfolio, high quality liquid assets, and focusing on yielding assets, strong fundamentals, and dividend shares to secure stream cash flow all the way. - Arbah are subject to operational risk; however Arbah has mitigation techniques consist of adequate trained professional team, sound internal process, controls and a well-established operational setup vs. its small size of operations. - Arbah are subject to strategy risk, however approved business plan consider having HNW and institutional clients onboard as targeted clients rather than retail, accordingly Arbah enjoy a wellserved small client base which does not require huge operations nor increased operational risk exposure. So from business risk perspective, Arbah targeted segment is HNW selective investors. As mentioned above, Arbah approved business plan focuses on sophisticated and institutional clients, with no intention to accommodate retail clients, who resulted in a small operation size comparing with other retail, oriented APs. - Arbah risk appetite adopted is low medium risk appetite, with no major or material risk arises during the implementation of this approved strategy. The material risk facing Arbah is local shares market crash, or long recession in real estate sector, for this Arbah invest in strong fundamental defensive sectors, and yielding assets as primary in implementing the investment and risk strategy. 4

Finally; there is no material risk from unforeseen events (external or internal) in future, which might cause business or operations to fail and produce un- expected harm losses. Table (1) below itemizing capital and capital requirement figures (in SR 000) for the current year projection: Pillar 1 Pillar 2 Minimum capital requirement ICAAP Credit risk 98,719 98,719 Market risk 2,075 2,075 Operational risk 4,070 4,070 Pillar 1 total (a) 104,864 (b) 104,864 Pillar 2 risk A 24,680 Pillar 2 risk B 623 Pillar 2 risk C 2,442 Pillar 2 total (c) 27,745 Additional capital to cover stress testing (d) 1,387 ICAAP capital requirement (e) = (b) + (c) +(d) 133,996 Additional capital required (f) = (e) (a) 29,132 Capital Base (g) 225,609 (h) 225,609 Surplus (Deficit) in Capital Base Capital Ratio (g) (a) 120,745 (g) / (a) 2.15 (h) (e) 91,613 (h) / (e) 1.68 Arbah capital policy is to hold a capital base at least equal to the current ICAAP. This capital level cannot be less than the minimum regulatory requirement, however as per ICAAP results Arbah holds 1.68 times. 5

2 INTRODUCTION 2.1 About this document This document is a summary of the Internal Capital Adequacy Assessment Process that was undertaken for the closing year-end position of 31 Dec 2015. The report also includes some background information concerning Arbah organization structure and the policies that support Arbah risk assessment and risk management systems. 2.2 Use of the ICAAP (an overview) The ICAAP report serves two key purposes: 1. It informs Arbah Board of Directors how Arbah assesses its risks, how Arbah intends to mitigate those risks and how much current and future capital is deemed necessary to support Arbah operations in light of those risks. 2. The ICAAP report is also the means by which Arbah evidences its internal capital adequacy assessment processes to the Regulation issued by CMA. The fact that this ICAAP is a report mandated by CMA last year; it was adopted at the highest levels of Arbah organization structure, risk management processes. ICAAP assumptions are being challenged and examined to ensure that Arbah continues to retain its focus on the risks it faces. 3. BACKGROUND 3.1 Organization & Capital Structure Arbah is a Saudi closed joint stock company registered in Dammam, Kingdom of Saudi Arabia under Commercial Registration No. 2050059020 dated 4 Rabi I, 1429H corresponding to March 12, 2008. The share capital of the Company amounting to SR 220 million is divided into 22 million shares of SR 10 each. Arbah is a single branch investment bank, whose principal function is to provide Investment banking services to its owning shareholders, It also provides Investment banking services to a range of private, business, institutional and HNW investors customers and is authorized and regulated by the Capital Market Authority (the "CMA ). The Internal Capital Adequacy Assessment Process (ICAAP) is introduced under Pillar II + Pillar of the prudential rules, which is contained in Part 6 (Article 66) and Annex 9 of the prudential rules issued by the Board of the Capital Market Authority (the "CMA ) pursuant to its resolution number 1-40-2012, dated 17/2/1434H corresponding to 30/12/2012G based on the Capital Market Law issued by Royal Decree No. M/30 dated 2/6/1424H. The ICAAP have been prepared in accordance with the CMA requirements. The ICAAP became effective as of end 2014. The main activities of Arbah are Dealing as principal and agent, underwriting, Managing establishment and management of mutual funds and portfolio management trading, Arranging, providing advisory and custody services for administrative arrangements and procedures relating to investment funds, portfolio management as per license of the ("CMA") number 37-7083. 6

The primary objective of the "Arbah Capital" is to ensure that Arbah maintains adequate risk capital, complies with the capital requirements laid down by the CMA and maintains a healthy capital ratio in order to support its business and maximize shareholder value. Arbah low risk business model has protected it through the turbulence experienced by the financial markets over recent years to the extent that it has remained profitable throughout some of this period and, unlike many other local investment banks, no need to seek an emergency increase in capital in order to shore up its capital position. Arbah Capital manages the capital base to cover risks inherent in the business. The adequacy of the capital is monitored using, among other measures, the rules and ratios established by the Basel Committee on Banking Supervision adopted by the CMA. Arbah Capital banking book is maintained, the majority of assets are denominated in Saudi Riyal, consisting of real estates, equities, mutual fund units, and investments in subsidiaries companies; while still minor portion is denominated in Qatari Riyal and USD. Trading book is maintained, the majority of assets and liabilities are denominated in Saudi Riyal. Regulatory capital consists of Tier 1 capital (core capital) and Tier 2 capital (supplementary capital). Arbah Tier 1 comprises share capital, statutory reserves, and audited retained earnings, less (intangible assets and unrealized loss of HFT and AFS investments). The following table summarizes the capital base after deductions for CAM calculation as of 31 December 2015: Capital Base SAR '000 Tier-1 capital Paid-up capital 220,000 Audited retained earnings 8,586 Share premium 0 Reserves (other than revaluation reserves) 3,154 Tier-1 capital contribution 0 Deductions from Tier-1 capital (32,291) Total Tier-1 capital 199,449 Tier-2 capital Subordinated loans 0 Cumulative preference shares 0 Revaluation reserves 0 Other deductions from Tier-2 (-) 0 Deduction to meet Tier-2 capital limit (-) 0 Total Tier-2 capital 0 TOTAL CAPITAL BASE 199,449 7

The following table summarizes the key items of the historical financial information of the company: Year Operating Income SAR Net Income after zakat SAR Total Assets SAR Total Equities SAR 2008 ) 3,730,875( (3,730,875) 217,634,748 215,042,184 2009 ) 6,158,040( (9,244,723) 212,383,600 205,809,379 2010 ) 10,702,474( (12,015,248) 198,938,206 192,377,771 2011 1,779,891 1,160,250 200,461,558 194,879,812 2012 12,626,401 10,004,795 218,701,958 210,509,003 2013 22,273,034 16,868,811 232,755,535 226,548,868 2014 28,722,010 21,122,010 265,831,719 246,685,001 2015 8,812,254 7,375,056 242,506,657 208,827,852 3.2 Overview of Exposures The majority of the Arbah business is conducted with its shareholder base, families and their network. The vast majority of the investment accounts maintained at Arbah fall into one of two types: the managing (DPM, mutual fund, and the private placement fund), and/or Dealing (the brokerage accounts). Arbah invests in shares portfolios in the local and GCC market in quality fundamental solid companies within limit guidelines reviewed from time to time by the investment committee of the Board of Directors. Arbah has exposure in real estate and other PE investments both in the kingdom and GCC market. Arbah and its clients hold its liquidity in prime high quality bank operating in the KSA after annual Due Diligence assessment been conducted, separate clients' accounts deposits placed in local currency, while sometimes Arbah own accounts hold in foreign currency with very minimal amounts to meet short term liabilities. The table summarizes the capital base held, compared with regulatory requirements, in terms of minimum capital requirements, capital adequacy coverage ratio and surplus in capital as of 31 December 2015: SAR '000 Capital Base 199,449 Tier-1 capital 199,449 Tier-2 Capital 0 Minimum capital requirements 103,433 Capital adequacy coverage ratio (times) 1.93 Surplus in Capital 96,016 As of 31 December 2015, Arbah capital ICAAP result showed that the capital adequacy coverage ratio and surplus in capital are 1.93 times and SAR 103,433,000 respectively. The calculation of the ICAAP result is based on an internal process during which management assesses the overall risks. The ICAAP will be updated regularly as capital requirements are subject to change due to changes in the business as well as risks and controls, both internally and externally. 8

4. SUMMARY OF CURRENT AND PROJECTED FINANCIAL AND CAPITAL POSITIONS The following table summarizes the key items of the current financial information of the company as of 31 March 2016: Period Operating Income/(Loss) SAR '000 Mar. 2016 3,505) Net Income /(Loss) after zakat SAR '000 Total Assets SAR '000 Total Equities SAR '000 ) ) 4,035) 227,224 195,278 The table summarizes the capital base held, compared with regulatory requirements, in terms of minimum capital requirements, capital adequacy coverage ratio and surplus in capital as of 31 March 2016: SAR '000 Capital Base 190,458 Tier-1 capital 190,458 Tier-2 Capital 0 Minimum capital requirements 97,329 Capital adequacy coverage ratio (times) 1.96 Surplus in Capital 93,129 As of 31 March 2016 It seems from the above table that the capital adequacy coverage ratio for Arbah capital is 1.96 times and there is a surplus in capital SAR '000' (93,129). The following table summarizes the key items of the projected financial information of the company for 2016, 2017 and 2018: Year Operating Income SAR '000 Net Income after zakat SAR '000 Total Assets SAR '000 Total Equities SAR '000 2016 13,260,417 9,260,417 269,340,336 229,544,381 2017 20,291,084 16,291,084 285,439,341 244,000,355 2018 25,724,817 20,624,817 309,187,338 264,165,861 The following table summarizes the projected capital base after deductions for CAM calculation for the projected financial information of the company for 2016, 2017 and 2018: 9

Actual Projected 2015 2016 2017 2018 SAR '000 SAR '000 SAR '000 SAR '000 Components of capital Core Capital - Tier 1 Issued and fully paid ordinary shares 220,000 220,000 220,000 220,000 Statutory reserves 3,154 4,080 5,709 7,771 Audited retained earnings 8,586 16,920 31,582 50,145 Total Tier 1 Capital 231,740 241,000 257,291 277,916 Deductions from Tier 1 Goodwill and intangible assets 3,822 3,021 2,240 1,410 Unrealised losses from HFT investments 5,557 870 420 114 Unrealised losses from AFS investments 22,912 11,500 2,300 1,230 Dividend expense from retained earnings 0 0 11,000 16,500 Total Tier-1 capital 199,449 225,609 241,331 258,662 Supplementary Capital - Tier 2 Revaluation reserves 0 0 0 0 Total Tier-2 capital 0 0 0 0 Total capital base 199,449 225,609 241,331 258,662 The table summarizes the projected capital base held, compared with regulatory requirements, in terms of minimum capital requirements, capital adequacy coverage ratio and surplus in capital for the projected financial information of the company for 2016, 2017 and 2018: Actual Projected 2015 2016 2017 2018 SAR '000 SAR '000 SAR '000 SAR '000 Capital Base 199,449 225,609 241,331 258,662 Tier-1 capital 199,449 225,609 241,331 258,662 Tier-2 Capital 0 0 0 0 Minimum capital requirements 103,433 104,863 93,324 90,922 Capital adequacy coverage ratio (times) 1.93 2.15 2.59 2.84 Surplus in Capital 96,016 120,745 148,007 167,740 10

It seems from the above tables that it is not envisaged that additional capital will be required to support Arbah planned growth in its products, and over the next three years. Furthermore; Arbah capital plans to maintain a strong capital base to support the development and growth of the business. Current and future capital requirements are determined on the basis of expectations for each business group, expected growth in future sources and uses of funds. The above tables showed that the capital adequacy coverage ratio is more 2 times for any projected year. As well; the surplus in capital (the buffer) for any projected year is very healthy, as it ensures that the company maintains adequate risk capital, and complies with the capital requirements laid down by the CMA. 5. CAPITAL ADEQUACY AND INTERNAL GOVERNANCE Almost the most severe stress scenario used by Arbah in the ICAAP considered the worst scenarios could happen. One or more stress scenarios are made in the major risk categories, consisting of one or more events in the applicable risk category. Furthermore, Arbah used a number of combined stress scenarios, combining multiple events across risk categories in order to ensure the utmost degree of stress in some cases. Where applicable, the stress test takes insurance coverage into account. The company s capital management is to ensure that the company maintains adequate risk capital, complies with the capital requirements laid down by the CMA and maintains a healthy capital ratio in order to support its business and maximize shareholder value. The Company manages the capital base to cover risks inherent in the business. The adequacy of the company s capital is monitored using, among other measures, the rules and ratios introduced under Pillar II of the prudential rules, which is contained in Part 6 (Article 66) and Annex 9 of the prudential rules issued by the CMA. Regulatory capital consists of Tier 1 capital (core capital) and Tier 2 capital (supplementary capital). The company s Tier 1 comprises share capital, statutory reserves; retained profit/losses brought forward, current interim cumulative net losses and unrealized gross losses arising from fair valuing equity securities. Tier 2 capital includes subordinated loans and revaluation reserves. From the regulatory perspective, all amount of the company s capital is in Tier 1 form. Arbah Capital approach to assessing capital adequacy has been in line with its risk appetite aligned with its current and future activities. To assess its capital adequacy requirements in accordance with the CMA prudential requirements, Arbah adopts the Standardized Approaches for its Credit Risk and Market Risk, and the Expenditure Based Approach for its Operational Risk. "Arbah Capital" capital adequacy policy is to maintain a strong capital base to support the development and growth of the business. Current and future capital requirements are determined on the basis of expectations for each business, expected growth in future sources and uses of funds. 11

Table: Illustrative Disclosure on Capital Adequacy Exposure Class Exposures before CRM SAR '000 Net Exposures after CRM SAR '000 Risk Weighted Assets SR '000 Capital Requirement SAR '000 Credit Risk On-balance Sheet Exposures Governments and Central Banks Authorised Persons and Banks 6,410 1,323 185 Corporates Retail Investments 152,481 530,776 74,308 Securitisation 0 Margin Financing 0 Other Assets 17,872 63,860 8,940 Total On-Balance sheet Exposures 176,763 595,959 83,433 Off-balance Sheet Exposures OTC/Credit Derivatives Repurchase agreements Securities borrowing/lending Commitments 28,400 28,400 3,976 Other off-balance sheet exposures 9,000 64,260 8,996 Total Off-Balance sheet Exposures 37,400 92,660 12,972 Total On and Off-Balance sheet Exposures 214,163 688,619 96,405 Prohibited Exposure Risk Requirement 0 0 0 Total Credit Risk Exposures 214,163 688,619 96,405 Market Risk Long Position Short Position Interest rate risks Equity price risks 14,450 2,601 Risks related to investment funds Securitisation/resecuritisation positions Excess exposure risks Settlement risks and counterparty risks Foreign exchange rate risks 17,776 356 Commodities risks. Total Market Risk Exposures 32,226 2,957 Operational Risk 4,070 Minimum Capital Requirements 103,433 Surplus/(Deficit) in capital 96,016 Total Capital ratio (time) 1.93 12

As mentioned before, Arbah capital policy is to hold a capital base at least equal to the current ICAAP. This capital level cannot be less than the minimum regulatory requirement, as of 31 December 2015, Arbah capital result showed that the capital adequacy coverage ratio and surplus in capital are 1.93 times and SAR 96,016,000 respectively. The following table summarizes the capital base held, compared with regulatory requirements, in terms of minimum capital requirements, capital adequacy coverage ratio and surplus in capital as of 31 December 2015: SAR '000 Capital Base 199,449 Tier-1 capital 199,449 Tier-2 Capital 0 Minimum capital requirements 103,433 Capital adequacy coverage ratio (times) 1.93 Surplus in Capital 96,016 5.1 Internal Structure & Organization 5.1.1 Board of Directors Arbah is headed by an effective Board of Directors which meets regularly and directs and controls the Company. There is a clear division of responsibility at the head of the company which ensures a balance of power and authority between the chairman, who controls and directs the Board meetings and the Chief Executive Officer, who carries responsibility for managing the company business. The Board consists eleven board members of a balance of both non-independent and independent directors as per CMA latest corporate governance regulation. 5.1.2 Audit & Compliance Committee Arbah has an Audit Committee to ensure that the Arbah policies and procedures are implemented with and that the recommendations of the Board and the external auditors are considered in full and implemented where appropriate. The Committee consists of three non-executive directors, who receive frequent reports and meet at least three times annually. It also oversees the work and considers the reports of the Arbah outsourced internal audit function, overseeing the implementation of their recommendations where appropriate, and giving due consideration to the effectiveness of internal controls. To make sure that the company comply with the requirements of the CMA and to ensure prudent management of the business, Arbah has established a range of internal controls, which have continued to operate effectively. Updates to Arbah Risk Register following management review are also made available to the Audit Committee. 5.1.3 Executive Directors The Managing Director, supported by the CEO and CRO is accountable for the whole business including key decisions and the day to day integrity of the staffing, records and procedures of Arbah. This incorporates overall responsibility for compliance with all relevant regulation, risk assessment and risk management. The CEO, supported by the Management Team, is responsible for financial and regulatory reporting, compliance and Arbah IT and systems. 13

5.1.4 Management Team The Executive Directors are supported by the Management Team with specific responsibilities i.e.: Back office and Middle office Managers: Day-to-day investment and back office operations, customer service, office staff, training and facilities. Business and marketing Development Managers: Marketing, new business development and investor literature/awareness. 5.2 Oversight of Strategy, Policies & Procedures Arbah overall structure has been assessed in relation to the recommended Internal & Governance guidelines produced by CMA implementing regulations (APRs). The structure is subject to annual review and approval by the Board. 5.2.1 Business Strategy, Plans and Budgets Business strategy, plans and budgets are the responsibility of the Managing Director working in conjunction with the CEO and Management Team. These are recommended to the Board for formal approval. Arbah updates it s rolling 3-Year Plan, incorporating a detailed budget for the next financial year, on an annual basis. 5.2.2 Risk Management Policies & Procedures Credit risk, market and liquidity risk are monitored and controlled according to agreed policies and procedures which handle Large Exposures. Other risks are identified and monitored by the Board, CEO and Management team by identifying and subject to regular review at a frequency reflecting the nature of the risk and degree of business threat. Risk management strategy and policies are the responsibility of the Board and Risk Manager working in conjunction with the CEO. They are subject to regular review (at least annually) and are approved by the Board. The Risk management and Compliance department consist of Head of department and 2 employees. 5.2.3 Assurance The Audit Committee monitors assurance, auditing, thus providing assurance evaluation to the Board. In addition to input from the Directors and Management Team, there are two principal sources of information for identifying potential problems and considering recommendations for improvement: Banking Audits undertaken by the Internal Auditor to identify any weaknesses in the Bank's risk management policies, business systems and/or IT systems and any breaches in compliance. Financial Audit undertaken by Arbah appointed External Auditors to approve the validity of financial statements and valuations. In terms of IT security and ensuring the strength of data access controls and protection against loss of data, in addition to appropriate internal audits, assurances and recommendations are also provided by Arbah IT Department or third party Audit firm to conduct IT security compliance audit. 14

6. RISK APPETITE AND POLICES Fundamental to our business is the prudent taking of risk in line with our strategic priorities. The primary objectives of risk management are to protect our financial strength and reputation, while ensuring that capital is well deployed to support business activities and grow shareholder value. Our risk management framework is based on transparency, management accountability and independent oversight. 6.1 Risk Appetite Arbah unique position, being wholly owned by well-known wealth experienced families in the eastern region, has necessitated a risk adverse approach to business. Arbah over-riding approach to risk is to safeguard the assets of its customers; treating customers fairly, principles have always been given the highest priority by Arbah throughout its history. Whilst Arbah Mission Statement highlights the objective of delivering an increasing return to its shareholders, achieving this objective is governed by Arbah ethical basis. Arbah key focus is to provide tailored and high quality investment banking services to its clients. Arbah offers quality investment banking products and services that give the customer a fair deal with the assurance that their assets will be looked after responsibly, as a consequence, Arbah is very selective about both the products and services it offers and its investment decisions. However, within these parameters, Arbah is professional in seeking an increasing profitable return through alert management of cost/income ratios. 6.1.1 Liquidity Policy In view of Arbah strong liquidity and the strength of its balance sheets, Arbah has no need for funding or borrowing from other financial institutions and the shareholders have no intention of ever going down this route unless strong fundamental economic opportunities arises. Liquidity policy is set out in Arbah Policy Statement. It is the responsibility of the Executive Officer, supported by the Management Team and overseen by the Board of Directors, to ensure that adequate liquidity is maintained at all times. The objective of Arbah liquidity policy is to ensure the management of net maturing liabilities in a controlled fashion and in a way that is consistent with the investment policy of Arbah and its ability to rise funding. The policy will be affected by adopting a two dimensional approach to liquidity management by: Control over net maturing assets and liabilities; and Holding investments in the form of liquid assets which can be easily realized to meet funding needs. i. Liquidity Risk Tolerance Liquidity mismatch positions across various time periods are deemed an appropriate basis for setting risk tolerance levels. Arbah ensures that it has sufficient maturing/realizable assets kept to meet all liabilities as they fall due. Liquidity mismatch positions take into account all available inflows and potential outflows, with early warning indicators are set for liquidity mismatch positions, so even applying the most severe stress tests, no illiquid positions circumstances are foreseen so far. 15

ii. Management Arbah acquires and holds investments easily realizable securities duly discounted where appropriate. These securities, together with Arbah balances of cash holdings, give significant cover across varying time periods, so Arbah ensures that it has sufficient maturing assets to meet outflows, based on its knowledge of liabilities which on a day to day basis, have responsibility for reinvesting maturing liquid assets. CEO and Finance Manager, they determine the liquidity profile of Arbah before re-investing in the market. The nature of the Arbah liquidity arrangements and current investments, together with the types of business in which it is engaged, means that it is difficult to envisage a situation whereby there would be insufficient funds to meet a liquidity shortfall. iii. Monitoring The Finance Manager calculates mismatch a position across varying time periods on a monthly basis and this is reviewed by CEO. Any possible mismatches that approach early warning indicator levels are reported to the Board of Director and corrected before tolerance levels are breached. There have been no liquidity mismatch breaches with these controls in place. 7. KEY RISK AND SENSITIVTIES 7.1 Credit risk The key risks facing Arbah have been identified with details of how management measures those risks and what controls and mitigates are in place to limit those risks. Throughout Arbah Risk Assessment process, simple internal stress and scenario testing is employed to try and ascertain what Arbah key sensitivities are and to try and ensure that adequate capital is in place to cover stressed scenarios, if any. 7.1.1 Identification & measurement The risk faced by Arbah is the failure of one or more of its major counterparties. A simple breakdown of credit exposures categorized according to the current investments exposures, with 20% fall scenario applies to measure it for the coming quarters. 7.1.2 Controls & Mitigation Credit risk is principally controlled by establishing and enforcing investment authorization limits, including set-off limits, and by defining exposure levels to counterparties. Daily monitoring of positions ensures that prudential limits are not exceeded. Arbah continues to adopt a conservative investment policy, which has resulted in a low investment default record. Impairment of Investment in Ibdar Bank An amount of SAR 1,200,000 of unlisted (PE) was impaired as of 31 December 2015 (2014: SAR 2,000,000). We have assessed the investment for impairment based on the latest reviewed financials as of September 30, 2015. There is no credit rating agencies (CRAs) used to rate Ibdar bank (Bahrain). Company Name Specific impairment SAR IBDAR BANK 1,100,000 Private equity Category Industry Country 16 Banks and Financial Institutions BAHRAIN

The majority of Arbah s propriety invested in unrated Saudi listed companies as well as unrated real estate's funds. Maturity breakdown of credit exposures: The following table summarizes the residual contractual maturity breakdown of the whole credit portfolio, broken down by major types of credit exposure as of 31 December 2015: Overdue Up to 1 month SAR 000 1 month to 6 month SAR 000 6 month to 1 year SAR 000 1-5 years SAR 000 Total SAR 000 Authorised Persons and Banks HFT Equity and Investments Funds 6,410 6,410 16,711 16,711 Receivables 9,838 9,838 AFS/Listed Equity 96,313 96,313 AFS/Real Estates 89,677 89,677 AFS/PE 11,701 11,701 Other Assets 7,567 4,290 11,857 119,434 9,838 7,567 105,668 242,507 Credit Risk Geographic Breakdown The following table summarizes the geographic distribution of the whole credit portfolio, broken down into significant areas by major types of credit exposure as of 31 December 2015: KSA QATAR BAHRAIN Total SAR 000 SAR 000 SAR 000 SAR 000 Authorised Persons and Banks 6,275 135 6,410 HFT Equity and Investments Funds 13,025 3,686 16,711 Receivables 9,838 9,838 AFS/Listed Equity 93,709 2,604 96,313 AFS/Real Estates 89,677 89,677 AFS/PE 350 11,351 11,701 Other Assets 11,857 11,857 Total 224,731 6,425 11,351 242,507 Geographic allocation percentage 92.7% 2.6% 4.7% 100% 17

As shown above, all assets are invested in KSA; except for the amount of SAR 6,425,000 invested in listed equities in Qatar and the amount of SAR 11,351,000 invested in AFS/PE in Bahrain. The below appendices (III, IV, V) are Illustrative disclosure on credit risk's risk weight, rated exposure, and credit risk mitigation (CRM). Appendix III: Illustrative Disclosure on Credit Risk's Risk Weight. Appendix IV: Illustrative Disclosure on Credit Risk's Rated Exposure. Appendix V: Illustrative Disclosure on Credit Risk Mitigation (CRM). App III: Illustrative Disclosure on Credit Risk's Risk Weight Exposures after netting and credit risk mitigation Risk Weights Governments and central banks Administrative bodies and NPO Authorised persons and banks Margin Financing Corporates Retail Past due items Investments Securitisation Other assets Off-balance sheet commitments Total Exposure after netting and Credit Risk Mitigation Total Risk Weighted Assets 0% 20% 6,275 6,275 1,255 50% 135 135 68 100% 28,400 28,400 3,976 150% 49,102 49,102 73,653 200% 300% 2,000 15,398 17,398 52,194 400% 101,379 101,379 405,516 500% 714% (include prohibited exposure) Average Risk Weight 2,474 9,000 11,474 81,924 1,323 530,776 63,860 92,660 688,619 618,586 Deduction from Capital Base 185 74,308 8,940 12,972 96,405 18

App IV: Illustrative Disclosure on Credit Risk's Rated Exposure Long term Ratings of counterparties Credit quality step 1 2 3 4 5 6 Unrated Exposure Class S&P AAA TO AA- A+ TO A- BBB+ TO BBB- BB+ TO BB- B+ TO B- CCC+ and below Unrated Fitch AAA TO AA- A+ TO A- BBB+ TO BBB- BB+ TO BB- B+ TO B- CCC+ and below Unrated Moody's Aaa TO Aa3 A1 TO A3 Baa1 TO Baa3 Ba1 TO Ba3 B1 TO B3 Caa1 and below Unrated Capital Intelligence AAA AA TO A BBB BB B C and below Unrated On and Off-balance-sheet Exposures Governments and Central Banks 9,000 Authorised Persons and Banks 34,810 Corporates Retail Investments 152,481 Securitisation Margin Financing Other Assets 17,872 Total 9,000 34,810 170,353 Short term Ratings of counterparties Credit quality step 1 2 3 4 Unrated Exposure Class S & P A-1+, A-1 A-2 A-3 Below A-3 Unrated Fitch F1+, F1 F2 F3 Below F3 Unrated Moody s P-1 P-2 P-3 Not Prime Unrated Capital Intelligence A1 A2 A3 Below A3 Unrated On and Off-balance-sheet Exposures Governments and Central Banks 9,000 Authorised Persons and Banks 34,810 Corporates Retail Investments 152,481 Securitisation Margin Financing Other Assets 17,872 Total 9,000 34,810 170,353 App V: Illustrative Disclosure on Credit Risk Mitigation (CRM) Exposure Class Exposures before CRM Exposures covered by Guarantees/ Credit derivatives Exposures covered by Financial Collateral Exposures covered by Netting Agreement Exposures covered by other eligible collaterals Exposures after CRM Credit Risk On-balance Sheet Exposures Governments and Central Banks Authorised Persons and Banks 6,410 6,410 Corporates Retail Investments 152,481 152,481 Securitisation Margin Financing Other Assets 17,872 17,872 Total On-Balance sheet Exposures 176,763 176,763 Off-balance Sheet Exposures OTC/Credit Derivatives Exposure in the form of repurchase agreements Exposure in the form of securities lending Exposure in the form of commitments 28,400 28,400 *Other Off-Balance sheet Exposures 9,000 9,000 Total Off-Balance sheet Exposures 37,400 37,400 Total On and Off-Balance sheet Exposures 214,163 214,163 19

7.2 Market Risk 7.2.1 Identification & measurement Arbah has market risk given that it operates a Trading Book; Arbah holds securities in the local stock market and Qatar stock market. Arbah does not have open positions in Commodities or foreign currencies at the reporting date excluding immaterial amount of Qatari Riyal and USD. Arbah does not enter into any financial derivatives contracts as it is not allowed from Shariah rules directions. The following table summarizes the equity price risks; and the risks related to investment funds; of the whole Trading Book portfolio as of 31 December 2015: Market Risk Interest rate risks Long Position Short Position Equity price risks 14,450 2,601 Risks related to investment funds Securitization/resecuritisation positions Excess exposure risks Settlement risks and counterparty risks Foreign exchange rate risks 17,776 356 Commodities risks. Total Market Risk Exposures 32,226 2,957 7.3 Liquidity Risk 7.3.1 Identification & Measurement Care is taken to ensure the maturity of liabilities is matched with liquid investments. In terms of the impact of Liquidity Risk on capital adequacy, further impacts considered for Liquidity Risk by balancing between illiquid investments vs. liquid to ensure the impacts on short and medium term liquidity needs. No illiquid positions circumstances are foreseen so far due to the fact that the company maintains healthy liquid assets to avoid any liquidity risk. The following table summarizes the liquidity ratios as of 31 December 2015: 20

Liquid assets to total assets 48.4% Short term assets to short term liabilities 125.7% Liquidity Coverage Ratio 363.8% Formula is as follows: Liquid Assets to total assets = (Cash and bank balances + Listed Equity and Investments Funds)/total assets Short term assets to short term liabilities = Assets with up to one year maturity/liabilities with up to one year maturity. Liquidity coverage ratio is calculated by dividing high quality liquid assets by short term obligations. A liquidity coverage ratio of greater than 100% is considered satisfactory. LCR reflects that the Company has sufficient high quality liquid assets to cover the net cash outflows over next 90 days. 7.4 Concentration Risk Identification, measurement and mitigation Arbah follows the CMA guidelines with respect to the definition and measurement of large exposures at the consolidated level as stipulated in the PRs for APs. Arbah does not have concentration of risk to individual counterparties in excess of prescribed threshold limit of 25% as at 31 December 2015: 7.5 Economic Risk It is important for Arbah to understand how sensitive its business is to the boom and bust phases of the economic cycle. 7.5.1 Identification & measurement Periods of high economic growth, are likely to see more significant increases in customer products and services and, potentially, higher than budgeted as confidence in the kingdom economy which massively reliance on oil production and prices. In considering the impact of a recession, a number of severe impacts have been modeled simply and simultaneous events have been laid over to arrive at a range of stressed scenarios. It is highly unlikely that these would all occur at the same time, but they have been linked together to fully test Arbah business model on top of the current base case. The common impacts for a severe economic downturn are as follows: - An increase in default rates - Property prices down The alternative scenarios applied are as follows: 1. Arbah / Customer investments to fall 2. Arbah /Client Investments to remain at budgeted levels 3. Combined economic stress with the sustained low interest rate scenario 21

With the various scenarios applied collectively, when considering capital adequacy there is an element of double-counting given that we assess many of the associated risks separately and hold capital against those individual risks credit risk, interest rate risk, strategic risk, third party dependency, fraud etc. Arbah selfassessment of capital requirements exceeds any worst-case scenario capital requirements. 7.5.2 Controls & mitigation Arbah quick reaction to any impact in a recession case served it very well in the past through the change of its business plan, conservative investment and asset allocations, and offering many alternative investments to client prove that economic stress would be less likely to affect the company expectations. 7.6 Operational Risk (Strategic Risk) Arbah consider the implications if she fails to meet the business development targets or if the strategy she pursue were to encourage their main customer. 7.6.1 Identification & measurement For assessing strategic risk, the following scenarios have been analyzed: - Fail to invest Arbah own properties. - Decline in client numbers (Dealing, Managing, and Advisory). - Zero growth / 50% decline in asset under management (AUM). In compliance with CMA requirements, Arbah has adopted the Basic Indicator Approach (BIA) in order to estimate the required capital charge for operational risk as it leads to a higher capital charge than the Expenditure Based Approach (EBA). (All amounts in 000 SAR) Approach 1 Year Gross Income Average Gross Income Risk Capital Charge (%) Capital Required Basic Indicator Approach (BIA) 2013 23,734 2014 38,812 27,133 15% 4,070 2015 18,852 Approach 2 Year Expenses Risk Capital Charge (%) Capital Required Expenditure Based Approach (EBA) 2015 14,627 25% 3,657 Maximum of (BIA or EBA) 4,070 7.6.2 Controls & mitigation Performance against strategic plans and budgets is monitored closely by the investment committee on a monthly basis. A financial review is presented to the Board at each Board Meeting. In terms of the consequences of strategic risk on capital adequacy, Arbah planning options represent potential actions as it is flexible to change the strategy according to market and business changes. Arbah has set limits for its business; limits are also broken down into business sector limits to ensure is not over-exposed in any single business sector. 22

7.7 Business Continuity (DR) Physical disasters affecting Arbah premises and continued operations could come in many different forms fire, flood, terrorism, failure of IT systems, etc. Each of these different threats presents a risk to Arbah. However, the impact of these different threats materializing will have many common implications all of which will require the innovation of Arbah Disaster Recovery and Business Continuity Plan. 7.7.1 Identification, measurement, controls and mitigates Arbah Disaster Recovery and Business Continuity Plan provide both protection to the Arbah continued operations following physical disasters and an assessment of potential costs. Business continuity contingency plans are tested, at least annually, with any identified failings in plans highlighted and priority given to resolving those failings. The invocation of the Disaster Recovery and Business Continuity Plan in the event of a severe disaster with widespread implications has been considered, although the circumstances of invoking the plan are likely to be less severe. However, in the event of a particular catastrophe or sequence of events that could prove terminal, Arbah would proceed in accordance with its Crisis Planning. Third party local Islamic Insurance does provide some mitigation against this risk. 7.8 Third Party Dependency (OR) There are some key dependencies that Arbah has in terms of some of its suppliers, particularly, in terms of the maintenance and support of its banking software and solutions. 7.8.1 Identification & measurement Estimates of the cost of replacing key suppliers are arrived at by maintaining awareness of alternative suppliers. Consideration is given to fat tail events when assessing potential impacts. 7.8.2 Controls & mitigation The CEO, business operations manager and IT services manager conduct annual reviews of the financial accounts of key suppliers. Close working relationships are maintained with all key suppliers and management ensures that service levels are acceptable. 7.9 Fraud (OR) 7.9.1 Identification & measurement In assessing fraud, a distinction is made between 'detected' and 'undetected' fraud. 'Detected' fraud is a regular occurrence and past experience can be used as the basis for its assessment. 'Undetected' fraud could involve significant amounts, although this is deemed unlikely given the controls that Arbah has in place. A conservative view has been taken on its estimation. All events, including fat tail events, would be mitigated significantly by the professional indemnity insurances that are in place. 7.9.2 Controls & mitigation There are numerous controls to guard against fraud and errors, including: - Account opening, mandate & account maintenance controls - Anti-Money Laundering controls - IT systems & security arrangements - Segregation of duties 23

- Independent audit of IT security - The professional indemnity insurances (partial mitigation) - Payment controls Arbah continues to refine its controls in light of detected fraud attempts, if any. 7.10 IT Security (OR) The integrity of IT systems and data security is given a high focus by management. Many high-profile failings of other organizations have hit the headlines in recent years. 7.10.1 Identification & measurement Estimates have been made of system replacement costs, emergency support costs, legal fees and fines should a serious breach occur. 7.10.2 Controls & mitigation Independent IT security audits guard against potential failures and security threats. IT security officer monitor the effectiveness of systems and controls. Arbah protects its network; procedures also ensure that data is adequately backed up in tapes and placed in disaster recovery servers. Means of tightening controls are frequently reviewed due to the critical importance of ensuring our data is kept secured. 7.11 Key Staff (OR) 7.11.1 Identification & measurement Arbah recognizes that due to its small size there is an operational dependency on key individuals. This risk is measured in terms of the estimated cost of replacing key individuals at short notice due to unforeseen circumstances. This includes the cost of employing an interim manager(s), recruiting replacement staff and the cost of extra working for other staff that might be required until the replacement gets up to speed. 7.11.2 Controls & mitigation It is Arbah policy to rotate roles and overlap responsibilities where appropriate, consistent with maintaining a segregation of duties. As a result, cover for periods of long absence, such as annual leave, has proved effective. A comprehensive log of operational procedures is maintained and regularly audited. This is a valuable reference point for all staff and is a key training resource. A training plan is incorporated into Performance Appraisal plans for all staff and the company Services Manager, in liaison with other managers, schedules training appropriately. Arbah Disaster Recovery Plan lists those key roles that would need to be covered if the Disaster Recovery Plan was invoked. The Chairman and CEO, in consultation with senior executives, are responsible for succession planning for key posts, such as the appointment of key staff once required. 24

7.12 Reputational Risk Reputational risk is the risk of loss arising from the adverse perception of the image of Arbah by customers, counterparties, investors or regulators. This is particularly relevant on two fronts: firstly, with the ethical standpoint that Arbah takes and, secondly, the fact that small investment banks have to convince customers that they are credible and can offer at least the basic, secure services expected of other big reputable investment banks. 7.12.1 Identification & measurement This risk can be seen as a knock-on effect of other risks materializing. It compounds the effect of other risks, such as strategy, fraud and regulatory risk. Reputational risk has not been modeled in isolation but is considered throughout Arbah ongoing risk review process and is built into the assessment of other risk. 7.12.2 Controls & mitigation The operational systems and controls in place help to mitigate this risk. The loyal customer base also provides some immunity although this would be challenged in the event of Arbah reputation suffering. 7.13 Other Operational Risks Risk Description Observations Residual Risk Regulatory/ Compliance / Conduct Competence/ administration Physical Security Reporting Risk Technology Risk The risk that credit risk measurement / mitigation techniques may prove less effective than expected Failure to comply with regulatory requirements and obligations (including the failure to act with Integrity). Failure due to human error, incompetence, lack of training etc. Risk of theft of holdings, documentation, equipment, etc Linked to Regulatory Risk, but specifically concerned with potential failings/inaccuracies in Arbah internal and external reporting The risk of new technologies (products and systems) giving other banks a competitive advantage This risk is incorporated in the assessment of other risks, such as, Economic Risk, Concentration Risk and Collateral Risk Arbah keeps up-to-date of CMA regulations. Arbah culture is closely aligned with that Shariah committee and shareholders. Assessment part-based on previous years' track record of past losses Documents are kept into a fireproof cabinet. Staff are kept aware of Security Procedures. All reports are subject to various reasonableness checks. Internal and external audits are also conducted. Technology in the investment banking sector is constantly changing. Arbah has a loyal customer base. Assessment considers the potential loss of business and the cost of viable new technologies. 25